Monster Top List Remote File Include Vulnerability Scan

Vulnerability Scan SummaryChecks for file includes in sources/functions.php

Detailed Explanation for this Vulnerability Test

Synopsis :

The remote web server contains a PHP application that is affected by a
remote file include vulnerability.

Description :

The remote host is running Monster Top List, a site rating script
written in PHP.

The installed version of Monster Top List fails to sanitize user input
to the 'root_path' parameter in sources/functions.php before using it
to include PHP code from other files. An unauthenticated attacker may
be able to read arbitrary local files or include a file from a remote
host that contains commands which will be executed on the remote host
subject to the rights of the web server process.

This flaw is only exploitable if PHP's 'register_globals' is enabled.

See also :

http://pridels.blogspot.com/2006/04/monstertoplist.html

Solution :

Unknown at this time.

Threat Level:

High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)

Click HERE for more information and discussions on this network vulnerability scan.